Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours.
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
RCE via OOM corruption
What is it?
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Evidence
- PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)Fortinet · US · 1 d ago
- CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)Palo Alto Networks · US · 1 d ago
- Vulnerabilities in PHP Affecting Cisco Products: October 2026Cisco · US · 10 h ago
- [Màj] Multiples vulnérabilités dans PHP (21 octobre 2026)CERT-FR · FR · 2 d ago
- Multiples vulnérabilités dans PHP (21 octobre 2026)CERT-FR · FR · 2 d ago
- UPOZORENJE: Kritične ranjivosti u PHP-u – objavljene zakrpeCERT.hr · HR · 1 d ago
- PHP-s tuvastati kaks kriitilist turvanõrkust: süsteemihaldajatel tuleb valmistuda turvauuenduseksCERT-EE · EE · 1 d ago
- Kritiska sårbarheter i PHPCERT-SE · SE · 1 d ago
- Critical security issue affecting PHPNCSC UK · GB · 1 d ago
- CSIRT Panamá Aviso 2026-oct-21: Vulnerabilidad Crítica en el núcleo de PHP permite ejecución remota de código (“PHP2Shell”) — CVE-2026-109619CSIRT Panamá · PA · 1 d ago
- CSIRT Panamá Aviso 2026-oct-21: Vulnerabilidad Crítica en el núcleo de PHP permite ejecución remota de código (“PHP2Shell”) — CVE-2026-109618CSIRT Panamá · PA · 1 d ago
- NCSC-2026-0443 [1.00] [H/H] Kwetsbaarheden verholpen in PHPNCSC-NL · NL · 1 d ago
- Critical Remote Code Execution in Drupal Core and the Entity List Module (CVE-2026-108097 and CVE-2026-108099) – 20261020011BtCIRT · BT · 1 d ago
- TT-CSIRT – 462.21.10.26- Critical Remote Code Execution Vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619)TT-CSIRT · TT · 1 d ago
- CERTFR-2026-AVI-1359_Multiples vulnérabilités dans PHPAMSN Monaco · MC · 1 d ago
- Saistībā ar globāli atklātām PHP ievainojamībām Latvijā ievieš preventīvus pasākumusCERT.LV · LV · 1 d ago
- [Security Blog] HKCERT Warns of Critical “PHP2Shell” Vulnerabilities: Businesses Must Immediately Review and Patch PHP Systems AI Accelerates Cyber Attacks and Defence, Further Shortening the Response Window Between Vulnerability Disclosure and ExploitationHKCERT · HK · 1 d ago
- 2026-018: Critical Vulnerabilities in PHPCERT-EU · EU · 1 d ago
- AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619CCCS · CA · 1 d ago
- Cenueshmëri kritike në PHP: AKSK bën thirrje për përditësimin e menjëhershëm të sistemeveAKSK Albania · AL · 1 d ago
- Kritiskas ievainojamības PHP programmatūrāCERT.LV · LV · 1 d ago
- PHP Multiple VulnerabilitiesHKCERT · HK · 23 h ago
- แจ้งเตือน พบช่องโหว่ PHP2Shell เสี่ยงถูกควบคุมเซิร์ฟเวอร์จากภายนอกThaiCERT · TH · 22 h ago
- Критични уязвимости в PHPCERT Bulgaria · BG · 18 h ago
- Critical Remote Code Execution in PHP (CVE-2026-109618 and CVE-2026-109619) – 20261021012BtCIRT · BT · 18 h ago
- CVE-2026-109618 and CVE-2026-109619 affecting PHP NCSC NZ · NZ · 4 h ago
- Ngā whakatūpatotanga Alerts NCSC NZ · NZ · 4 h ago
- 21 October 2026 21 October 2026 Critical Vulnerabilities in PHP (PHP2Shell) Attackers can exploit multiple critical vulnerabilities in PHP to achieve unauthenticated remote code execution. Patch immediately. AlertsCSA Singapore · SG · 4 h ago
- PHP 보안취약점(PHP2Shell) 관련 기업 보안 대응 수칙KrCERT · KR · 4 h ago
- PHP 제품 보안 업데이트 권고KrCERT · KR · 4 h ago
- NÚKIB upozorňuje na kritické zranitelnosti v PHP - jediným řešením je aktualizaceNÚKIB · CZ · 4 h ago
- Riasztás a PHP futtatókörnyezet kritikus sérülékenységeiről 2026. 10. 21. NKI GovCERT-Hungary · HU · 4 h ago
- 2026. 10. 22. A PHP2Shell javítások megérkeztek, de a leállások és a kihasználási kísérletek miatt még nem ért véget az incidens NKI GovCERT-Hungary · HU · 4 h ago
- CVE-2026-109619 Kritikus PHP, PHP Group 2026. 10. 21. NKI GovCERT-Hungary · HU · 4 h ago
- CVE-2026-109618 Kritikus PHP, PHP Group 2026. 10. 21. NKI GovCERT-Hungary · HU · 4 h ago
- NKSC paskelbė DUK apie PHP kritinius pažeidžiamumusNKSC Lithuania · LT · 4 h ago
- Svarbi informacija apie 2026 m. spalio 21 d. planuojamą PHP programinės įrangos atnaujinimąNKSC Lithuania · LT · 4 h ago
- Alertă de securitate: Vulnerabilități critice identificate în PHP CERT-GOV-MD (STISC) · MD · 4 h ago
- Некој се обидел да ги искористи ранливостите во PHP2Shell 4 дена пред нивното јавно објавувањеMKD-CIRT · MK · 4 h ago
- Критична ранливост во PHP овозможува далечинско извршување на злонамерен код без автентикацијаMKD-CIRT · MK · 4 h ago
- НКЦКИ предупреждает об угрозе эксплуатации уязвимостей в PHPNKTsKI (GosSOPKA) · RU · 4 h ago
- Критичне рањивости у PHP2ShellSRB-CERT · RS · 4 h ago
- Kritické zraniteľnosti v PHPSK-CERT · SK · 4 h ago
- Horizon3 Promotes Keith Poyser to General Manager, EMEA Following More Than 260% Regional Revenue GrowthHorizon3.ai · US · 7 d ago
- Horizon3 and Pax8 Expand Partnership to Bring Autonomous Security Testing to MSPs Across EuropeHorizon3.ai · US · 6 d ago
- Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding ResearchRapid7 · US · 6 d ago
- Meeting the ECB’s AI-Enabled Cybersecurity Supervisory Recommendations with NodeZero®Horizon3.ai · US · 6 d ago
- CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildRapid7 · US · 3 d ago
- Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779Rapid7 · US · 3 d ago
- Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside inRapid7 · US · 3 d ago
- Horizon3 expands in Singapore to accelerate AI‑native proactive security across Southeast AsiaHorizon3.ai · US · 2 d ago
- CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCEHorizon3.ai · US · 2 d ago
- Horizon3 Surpasses $100 Million ARR, Marking a Key Milestone in the Shift to Continuous, Production-Safe Autonomous SecurityHorizon3.ai · US · 2 d ago
- CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code ExecutionHorizon3.ai · US · 2 d ago
- Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)Huntress · US · 1 d ago
- Major security alert: PHP vulnerable to critical RCE, attacks ongoingPatchstack · EE · 1 d ago
- Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 DaysRapid7 · US · 1 d ago
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the InternetWiz · US · 1 d ago
- CVE-2026-109618 / CVE-2026-109619 | What is KnownHorizon3.ai · US · 1 d ago
- Two critical RCEs in PHP coreCisco Talos · US · 1 d ago
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)Kaspersky · RU · 1 d ago
- CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPRapid7 · US · 1 d ago
- PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites OfflineSocket · US · 1 d ago
- Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619Palo Alto Unit 42 · US · 1 d ago
- Audit-Ready Isn’t Attack-Ready.Horizon3.ai · US · 1 d ago
- PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update NowWordfence · US · 1 d ago
- PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency PatchesSocket · US · 1 d ago
- Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing FoundWordfence · US · 23 h ago
- The Current Landscape of OAuth AttacksPalo Alto Unit 42 · US · 7 h ago
- PHP2Shell Exposure Depends on More Than Whether You Use PHPHorizon3.ai · US · 5 h ago
- Unofficial backports for CVE-2026-109618 / CVE-2026-109619 to EOL PHP 7.3 (EL7) and 5.4/5.3 (Amazon Linux)oss-security · INT · 5 h ago
- Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global stateoss-security · INT · 4 h ago
- Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global stateoss-security · INT · 4 h ago
- Blog post SonarQube container scanning is now in open beta Scan the container images you build and ship for vulnerabilities and malicious packages. Included with SonarQube Advanced Security. Join the open beta. Read articleSonar · CH · 4 h ago
- CVE-2026-76268 | Splunk Enterprise Patroni REST API Missing Authentication VulnerabilityHorizon3.ai · US · 4 h ago
- CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6)oss-security · INT · 3 h ago
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertThe Hacker News · IN · 1 d ago
- Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security PatchesInfosecurity Magazine · GB · 1 d ago
- PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn'tThe Hacker News · IN · 1 d ago
- PHP releases emergency fixes for 2 critical vulnerabilitiesCyberScoop · US · 1 d ago
- ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on FireWired · US · 1 d ago
- Widespread PHP Flaw May Cause Many Site Outages TodayKrebs on Security · US · 1 d ago
- 'PHP2Shell' Bugs Signal Red Alert for Security IndustryDark Reading · US · 1 d ago
- PHP2Shell Exploitation Started Days Before PatchesSecurityWeek · US · 14 h ago
- PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability DisclosureInfosecurity Magazine · GB · 14 h ago
- What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customersHelp Net Security · HR · 14 h ago
- New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619Help Net Security · HR · 12 h ago
- Tech and Security Companies Respond to PHP2Shell VulnerabilitiesSecurityWeek · US · 12 h ago
- Amazon says PHP2Shell exploitation began 4 days before patchesBleepingComputer · US · 11 h ago
- PHP : deux vulnérabilités critiques déjà exploitées en cours de correctionLeMagIT · FR · 1 d ago
- [PHP2Shell 파장] 세계 웹사이트 70% 쓰는 PHP, 치명적 보안 결함 발견... 정부·기업 '비상'Boannews · KR · 23 h ago
- [PHP2Shell 파장] 서버 장악하고 개인정보 빼간다... 예상 공격 시나리오Boannews · KR · 22 h ago
- [PHP2Shell 파장] AI로 협력한 보안 업계, PHP 치명적 결함 발견에 핵심 역할Boannews · KR · 22 h ago
- [PHP2Shell 파장] 국내 기업, 대응 어떻게?... “패치 공개는 끝 아닌 전쟁 시작, 스피드!”Boannews · KR · 22 h ago
- [PHP2Shell 파장] 키오스크 화면 눌렀더니 시스템 털렸다... 웹의 본체 PHP는 무엇?Boannews · KR · 22 h ago
- 에버스핀, ‘PHP2셸’ 원격코드실행 취약점 사전 차단... “공식 패치 전 방어망 구축”Boannews · KR · 21 h ago
- 팔로알토 “세계 PHP 인스턴스 2200만 개 노출... AI 기반 선제 방어 시급”Boannews · KR · 19 h ago
- [PHP2Shell 파장] “PHP 즉시 업데이트하고 패치 후 로그 점검”... 과기정통부, 기업 대응 수칙 배포Boannews · KR · 18 h ago
- 스틸리언, 사이버위기 ‘주의’ 발령에 PHP 취약점 무상 진단 지원Boannews · KR · 18 h ago
- CISA呼籲儘速修補PHP2ShelliThome · TW · 17 h ago
- php2shell: Updates trudeln ein, viele Webseiten offline, Angriffe laufenheise · DE · 17 h ago
- 研究人員借助AI力量找出存在超過10年的資安漏洞PHP2ShelliThome · TW · 17 h ago
- [PHP2Shell 파장] “개인정보 유출 우려... DB 접근권한 최소화 시급”Boannews · KR · 16 h ago
- Alerta d'una "vulnerabilitat crítica" que pot afectar webs i serveis en línia d'AndorraDiari d'Andorra · AD · 16 h ago
- 금융권, PHP 취약점 긴급 보안권고... “금융사 웹 API 즉각 점검해야”Boannews · KR · 15 h ago
- Vulnérabilités PHP : de nombreux sites Web déconnectés par précautionLeMagIT · FR · 15 h ago
- PHP2Shell: Wie eine Server-Schwachstelle Behörden aus dem Netz kegelteDer Spiegel · DE · 12 h ago
- PHP-Schwachstellen: Auch Geräte daheim können betroffen seint-online · DE · 8 h ago
- Sicherheitslücke betrifft drei Viertel aller WebseitenLiechtensteiner Vaterland · LI · 4 h ago
- Nyhet ”Miljoner” attacker mot säkerhetshålen i php Av Mikael Markander 22 okt. 2026 2 min SäkerhetComputer Sweden · SE · 4 h ago
- Nyhet Akuta säkerhetshål i php – sajter kan behöva stängas ner Av Mikael Markander 21 okt. 2026 1 min SäkerhetComputer Sweden · SE · 4 h ago
- Government agencies given 7 days to patch critical PHP flawsGraphic Online · GH · 4 h ago
- Cybersécurité : le CERT-MU alerte sur deux failles critiques affectant PHPDefimedia · MU · 4 h ago
- Singapore organisations urged to patch critical PHP flaws immediately amid cyberattack threatCNA · SG · 4 h ago
- PHP2Shell: una IA descubre una falla de seguridad que amenaza a millones de sitios web en todo el mundoLa Tercera · CL · 4 h ago
- PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)Hacker News · INT · 1 d ago
- Cloudflare deploys protections against php2shell vulnerabilityHacker News · INT · 1 d ago
- PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)Hacker News · INT · 1 d ago
Exploitation
- Public proof of concept
- Exploited in the wild
- Listed as known exploited
- CVSS
- 9.2
- EPSS
- 5.3%
- First seen
- 1 d ago
- Status
- confirmed
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.